Estimation apparatus, estimation method, and computer-readable storage medium

Abstract

An estimation apparatus 1 includes: a correlation index estimation unit 2 configured to receive a variable output by a component 21 as an input, and estimate correlation index information indicating a range that a value of the variable and a correlation can take after a predetermined time, at a normal time; an abnormality degree calculation unit 3 configured to calculate an abnormality degree using the correlation index information; and a causal effect estimation unit 4 configured to estimate a causal effect expressing an index indicating that an abnormality propagates to a variable output by the component 21.

The invention claimed is: 
     
       1. An estimation apparatus realized by a computer comprising:
 a processor; and 
 a memory storing instructions executable by the processor to: 
 receive a variable output by a component of a target system as an input, and estimate correlation index information indicating a range that a value of the variable and a correlation can take after a predetermined time, at a normal time; 
 calculate abnormality degree information indicating an abnormality degree using the correlation index information; 
 estimate a causal effect expressing an index indicating that an abnormality propagates to the variable output by the component; and 
 identify, based on the causal effect estimated based on the variable output by the component at the normal time, and based on the variable output by the component at a time subsequent to the normal time, an abnormality factor as to why the target system has entered an abnormal state at the time subsequent to the normal time, due to cyber attack, failure, or degradation, 
 wherein the causal effect expressing the index indicating that the abnormality propagate to the variable output by the component is determined based on the variable as output by the component at the normal time when the target system has not entered the abnormal state, and does not require the variable as output by the component at an abnormal time when the target system has entered the abnormal state, thereby reducing an amount of data to be collected on which basis to determine the causal effect and permit identification of the abnormality factor at the time subsequent to the normal time as to why the target system has entered the abnormal state. 
 
     
     
       2. The estimation apparatus according to  claim 1 ,
 wherein the instructions are executable by the processor to further: 
 estimate, using a second variable output by a second component that influences a first variable output by a first component, first index information expressing an index indicating that the first variable is achieved at the normal time; and 
 estimate, using the first index information, abnormality propagation information expressing that an abnormality propagates to a third variable output by a third component influenced by the first variable, by changing the first variable. 
 
     
     
       3. The estimation apparatus according to  claim 2 ,
 wherein the instructions are executable by the processor to further: 
 receive the abnormality degree information and the abnormality propagation information as input, and estimate abnormality factor information regarding the abnormality factor of the component provided in the target system. 
 
     
     
       4. The estimation apparatus according to  claim 3 ,
 wherein the instructions are executable by the processor to further: 
 receive, as input, the second variable that influences the first variable output by the first component and is output by the second component that is in a causal relationship with the first component, and estimate the first index information expressing that the first variable is achieved after the predetermined time at the normal time,
 estimate second index information expressing that the third variable output by the third component influenced by the first component is achieved after predetermined time using the first index information, 
 estimate third index information expressing that the third variable is achieved after the predetermined time, using a fourth variable obtained by shifting the first variable, and 
 estimate the abnormality propagation information expressing the index indicating that the abnormality propagates from the first variable to the third variable using the second index information and the third index information. 
 
 
     
     
       5. The estimation apparatus according to  claim 4 ,
 wherein the correlation index information and the first to third index information are each an occurrence probability or a normality degree. 
 
     
     
       6. The estimation apparatus according to  claim 3 ,
 wherein the instructions are executable by the processor to further: 
 estimate the abnormality factor information using Bayesian processing. 
 
     
     
       7. An estimation method performed by a computer and comprising:
 receiving a variable output by a component of a target system as an input, and estimate correlation index information indicating a range that a value of the variable and a correlation can take after a predetermined time, at a normal time; 
 calculating abnormality degree information indicating an abnormality degree using the correlation index information; 
 estimating a causal effect expressing an index indicating that an abnormality propagates to the variable output by the component; and 
 identifying, based on the causal effect estimated based on the variable output by the component at the normal time, and based on the variable output by the component at a time subsequent to the normal time, an abnormality factor as to why the target system has entered an abnormal state at the time subsequent to the normal time, due to cyber attack, failure, or degradation, 
 wherein the causal effect expressing the index indicating that the abnormality propagate to the variable output by the component is determined based on the variable as output by the component at the normal time when the target system has not entered the abnormal state, and does not require the variable as output by the component at an abnormal time when the target system has entered the abnormal state, thereby reducing an amount of data to be collected on which basis to determine the causal effect and permit identification of the abnormality factor at the time subsequent to the normal time as to why the target system has entered the abnormal state. 
 
     
     
       8. The estimation method according to  claim 7 , further comprising:
 estimating, using a second variable output by a second component that influences a first variable output by a first component, first index information expressing an index indicating that the first variable is achieved at the normal time; and 
 estimating, using the first index information, abnormality propagation information expressing that an abnormality propagates to a third variable output by a third component influenced by the first variable, by changing the first variable. 
 
     
     
       9. The estimation method according to  claim 8 , further comprising:
 receiving the abnormality degree information and the abnormality propagation information as input, and estimate abnormality factor information regarding the abnormality factor of the component provided in the target system. 
 
     
     
       10. The estimation method according to  claim 9 , further comprising:
 receiving, as input, the second variable that influences the first variable output by the first component and is output by the second component that is in a causal relationship with the first component, and estimate the first index information expressing that the first variable is achieved after the predetermined time at the normal time, 
 estimating second index information expressing that the third variable output by the third component influenced by the first component is achieved after predetermined time using the first index information, 
 estimating third index information expressing that the third variable is achieved after the predetermined time, using a fourth variable obtained by shifting the first variable, and 
 estimating the abnormality propagation information expressing the index indicating that the abnormality propagates from the first variable to the third variable using the second index information and the third index information. 
 
     
     
       11. The estimation method according to  claim 9 ,
 wherein the correlation index information and the first to third index information are each an occurrence probability or a normality degree. 
 
     
     
       12. The estimation method according to  claim 9 ,
 wherein the abnormality factor information is estimated using Bayesian processing. 
 
     
     
       13. A non-transitory computer-readable recording medium storing instructions causing a computer to carry out:
 receiving a variable output by a component of a target system as an input, and estimate correlation index information indicating a range that a value of the variable and a correlation can take after a predetermined time, at a normal time; 
 calculating abnormality degree information indicating an abnormality degree using the correlation index information; 
 estimating a causal effect expressing an index indicating that an abnormality propagates to the variable output by the component; and 
 identifying, based on the causal effect estimated based on the variable output by the component at the normal time, and based on the variable output by the component at a time subsequent to the normal time, an abnormality factor as to why the target system has entered an abnormal state at the time subsequent to the normal time, due to cyber attack, failure, or degradation, 
 wherein the causal effect expressing the index indicating that the abnormality propagate to the variable output by the component is determined based on the variable as output by the component at the normal time when the target system has not entered the abnormal state, and does not require the variable as output by the component at an abnormal time when the target system has entered the abnormal state, thereby reducing an amount of data to be collected on which basis to determine the causal effect and permit identification of the abnormality factor at the time subsequent to the normal time as to why the target system has entered the abnormal state. 
 
     
     
       14. The non-transitory computer readable recording medium according to  claim 13 , wherein the instructions cause the computer to further carry out:
 estimating, using a second variable output by a second component that influences a first variable output by a first component, first index information expressing an index indicating that the first variable is achieved at the normal time; and 
 estimating, using the first index information, abnormality propagation information expressing that an abnormality propagates to a third variable output by a third component influenced by the first variable, by changing the first variable. 
 
     
     
       15. The non-transitory computer readable recording medium according to  claim 14 , wherein the instructions cause the computer to further carry out:
 receiving the abnormality degree information and the abnormality propagation information as input, and estimate abnormality factor information regarding the abnormality factor of the component provided in the target system. 
 
     
     
       16. The non-transitory computer readable recording medium according to  claim 15 , wherein the instructions cause the computer to further carry out:
 receiving, as input, the second variable that influences the first variable output by the first component and is output by the second component that is in a causal relationship with the first component, and estimate the first index information expressing that the first variable is achieved after the predetermined time at the normal time, 
 estimating second index information expressing that the third variable output by the third component influenced by the first component is achieved after predetermined time using the first index information, 
 estimating third index information expressing that the third variable is achieved after the predetermined time, using a fourth variable obtained by shifting the first variable, and 
 estimating the abnormality propagation information expressing the index indicating that the abnormality propagates from the first variable to the third variable using the second index information and the third index information. 
 
     
     
       17. The non-transitory computer readable recording medium according to  claim 14 , wherein the instructions cause the computer to further carry out:
 wherein the correlation index information and the first to third index information are each an occurrence probability or a normality degree. 
 
     
     
       18. The non-transitory computer readable recording medium according to  claim 15 ,
 wherein the abnormality factor information is estimated using Bayesian processing.